Timetics CVE-2026-39432

No special conditions-remote unauthenticated exploitation against default configurations of Timetics plugin versions through 1.0.53. The CVSS vector PR:N/AC:L confirms no authentication or complex prerequisites. The vulnerability exists in standard plugin installations without requiring non-default settings, specific WordPress configurations, or enabled features. Exploitation is limited only by network reachability to the WordPress site; sites behind IP restrictions or private networks reduce attack surface. No user interaction (UI:N) required, enabling fully automated exploitation. The authorization bypass affects publicly accessible plugin endpoints, making any internet-facing WordPress installation with Timetics installed and activated immediately vulnerable.

Real-world risk is HIGH for sites using Timetics. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation with low complexity-attackers need only network access to vulnerable WordPress sites running the plugin. The attack requires no special conditions, no user interaction, and no authentication, making it trivially exploitable at scale via automated scanning. High confidentiality impact (C:H) suggests exposure of sensitive booking data, customer information, or administrative details, while low integrity impact (I:L) indicates potential unauthorized modifications to bookings or settings. EPSS score and KEV status are not provided, so widespread exploitation status remains unknown. However, Patchstack's involvement suggests professional vulnerability research and likely notification to affected users. No public POC is confirmed from available data. The primary risk is data exposure in booking systems handling customer PII, appointment details, or payment information. Sites using Timetics for business-critical scheduling face operational risk from unauthorized booking manipulation. Authentication bypass tag confirms the authorization flaw extends to authentication boundaries, elevating severity beyond typical broken access control.

An unauthenticated attacker identifies a WordPress site running Timetics 1.0.53 through automated plugin version enumeration. They craft HTTP requests directly to the plugin's REST API endpoints or AJAX handlers, bypassing missing authorization checks to enumerate customer booking data, export appointment schedules with contact details, or modify booking availability to disrupt business operations. With low attack complexity and no authentication required, attackers can script mass exploitation against all WordPress sites running vulnerable Timetics versions discovered via search engines or WordPress plugin reconnaissance.